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The MAILING DATE of this communication appears on the cover sheet with the correspondence address ~ 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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DETAILED ACTION 

1. This Office action is responsive to the following communication: Amendment filed on 5 February 
2007. 

Response to Amendment 

Claims 1-5, 7-12, and 14-22 are pending. 
Claims 1, 3, 7-12, and 14-22 have been amended. 
Claims 6 and 13 have been cancelled. 

Information Disclosure Statement 
The information disclosure statement (IDS) submitted on 5 February 2007 is in compliance with 
provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by 
examiner. 

Claim Rejections - 35 USC§ 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made to a 
person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

7. Claim 1-5, 7-10, 12, 14-17, and 19-22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Lei (U.S. Patent No. 6,487,552, hereinafter referred to as LEI), filed on 5 October 
1998, and issued on 26 November 2002, and further in view of Devine et al (U.S. Patent No. 6,968,571, 
hereinafter referred to as DEVINE), filed on 18 July 2003, and issued on 22 November 2005. 

8. As per independent claims 1, 19 and 21, LEI, in combination with DEVINE, discloses: 



2. 
3. 
4. 



5. 

the 

the 
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A computer-implemented method for retrieving information from a knowledge base, the 
method comprising: 

receiving a search query for information in a manner that identifies which one of 
multiple knowledge bases that stores the information {See lei, C6:L65-C8:L3i}; 

building a search request that contains the received search query and a security 
pattern {See LEI, C14:L4-32, wherein this reads over "[t]he policy function then selectively adds 
one or more predicates to the received query"} obtained from a security service, the 
security service being configured to control access to information in each of the 
multiple knowledge bases {See DEVINE, C3:L21-22, wherein this reads over "centralized user 
authentication to insure that the user has valid access to the system"; and C3:L35-45, wherein this 
reads over "the set of remote services available for each user is unique and depends on each user's 
subscriptions to the services"} and further configured to provide the security pattern by 

a^ retrieving a security strategy associated with the identified knowledge base, 
the security strategy identifying one or more control entities {See LEI, cii:Li3-29, 
wherein this reads over "a security policy may allow special classes of users to have special context 
modification privileges, or have special rules that govern certain types of context attributes"} that 
are authorized to access the identified knowledge base {See devine, ci6:L46-55, 
wherein this reads over "[t]he entitlements represent specific services the user has subscribed and 
has privilege to access"}; 

b) retrieving a security profile corresponding to each of the one or more control 
entities, each such security profile including an attribute {See devine, ci6:L46-55, 
wherein this reads over "describes what entitlements the user may have within any single service"}; 
and 

c^i generating the security pattern from attributes in the one or more retrieved 
security profiles {See DEVINE, C3:L46-67, wherein this reads over "the user information is 
maintained for the duration of a logon session, allowing both the backplane and the client 
applications to access the information as needed throughout the duration of the session"; and 
C16:L56-C17:L6, wherein this reads over "the backplane stores the user specific entitlements in the 
memory for other processes to access"}jj|nd 

using the search request to retrieve information from the identified knowledge base, 
wherein the retrieved information is responsive to the received search query, and 
wherein the retrieved information has one or more attributes that correspond to 
the one or more attributes from which the security pattern is generated {See lei, 
C13:L55-C14:L32, wherein this reads over "[d]ynamic predicate attachment involves selectively 
adding predicates to queries that access database objects, such as tables and views"}. 

While LEI may not expressly disclose the retrieval of a security profile and the generation of a 

security pattern from attributes in the retrieved security profiles, DEVINE provides a system wherein a 

user's entitlements to various remote services is determined and used to validate access to said remote 

services. Therefore, it would have been obvious to one of ordinary skill in the art at the time the 

invention was made to modify the above invention suggested by LEI by combining it with the invention 
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disclosed by DEVINE. The results of this combination would lead to a method wherein the user logon 
information may be used in identifying the user as a control entity to a specified knowledge base. With 
said information, the corresponding security profile may be retrieved and a security pattern generated 
from said retrieved security profile. 

One of ordinary skill in the art would have been motivated to do this modification so that a 
search query may only be executed upon knowledge bases to which the user has security access to. 

9. As per dependent claim 2, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 1, wherein the search query is input by a 
user {See LEI, C1:L52-61, wherein this reads over "views may be queried by users"}. 

10. As per dependent claim 3, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 1, wherein the method comprises: 

using the search request to retrieve information from the knowledge base using a 
search index {See LEI, C7:L37-40 # wherein this reads over "[i]f department is a indexed column, 
the execution plan for the query call the My_department function ... but it will only be an indexed 
lookup for the query that invokes GetContextValue."}. 

11. As per dependent claim 4, it would be inherent for the search query to include knowledge 
base search terms since without the inclusion of the search terms, the search query would not be able to 
return any relevant data pertinent to the search query. 

12. As per dependent claim 5, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 4, wherein the knowledge base search 
terms contain textual search terms {See lei, ci2:Ll2-55, wherein this reads over "SELECT * 
from t WHERE t.lang=GetContextValue(mysession, language)"}. 

13. As per dependent claims 7 and 14, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 1, wherein the one or more control entities 
are selected from a group consisting of a user name, a country code, a region, and a 
organization {See LEI, Cll:L13-29, wherein this reads over "a security policy may allow special classes 
of users to have special context modification privileges w , "a security Jevel attribute may have the rule that 
everyone except the CEO may only decrease the attribute value" and "[i]f the current user is not the CEO, 
then procedure 250 reads the current value of the securityjevel attribute"}. 
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14. As per dependent claims 8 and 15, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 1, wherein the security pattern contains a 
set of attributes that each have a name/value pair {See lei, ci2:L4-io, wherein this reads 
over w [t]he attributes included in the USERENV namespace may include, but are not limited to: the identity 
of the logon user; and C12:L12-55, wherein this reads over 
"GetContextValue(<namespace>,<attribute>)"}. 

15. As per dependent claims 9 and 16, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 12, wherein the method further comprises: 

using the security search strategy to build a second security pattern having a set of 
attributes to be used with the search query when searching for information in 
the identified knowledge base, such that the information is associated with the 
set of attributes in the security pattern and also with the set of attributes in the 
second security pattern {See LEI, C14:L4-32, wherein this reads over "the database server 212 
invokes a policy function that has been bound to table t. The policy function then selectively adds 
one or more predicates to the received query", "SELECT * from t", "SELECT * from t WHERE 
t.lang=GetContextValue(language)", and "[t]he logic implemented in the policy function to determine 
which predicates, if any, should be appended to incoming queries may be arbitrarily complex"}. 

16. ' As per dependent claims 10 and 17, LEI, in combination with DEVINE, discloses: 

The computer-implemented method of claim 1, wherein the set of attributes from which 
the security pattern is generated includes attributes selected from a group consisting 
of a symptom type, a status, a validation category, a priority type, and a priority level 
{See LEI, C14:L4-32, wherein this reads over "assume that access to table t is only allowed on weekdays 
(Monday-Friday), unless the access is performed by a database administrator"}. 

17. As per independent claims 12, 20 and 22, LEI, in combination with DEVINE, discloses: 

A computer-implemented method for building a request to search for information in a 
knowledge base, the method comprising: 

receiving a search query for information in a manner that identifies which one of 
multiple knowledge bases that stores the information {See lei, C6:L65-C8:L31>; 

obtaining a security strategy that is associated with the identified knowledge base 
{See LEI, C13:L55-C14:L32, wherein this reads over "dynamic predicate attachment"'; and C16:L24- 
33, wherein this reads over w a policy function can produce a filtering predicate for a particular table 
of view object based on the current state of the user session"! , the security Strategy 
identifying one or more control entities {See lei, cil:Ll3-29, wherein this reads over "a 
security policy may allow special classes of users to have special context modification privileges, or 
have special rules that govern certain types of context attributes"} that are authorized to 
access the identified knowledge base {See DEVINE, Cl6:L46-55, wherein this reads over 
M [t]he entitlements represent specific services the user has subscribed and has privilege to access"}; 
and 

retrieving a security profile corresponding to each of the one or more control entities, 
each such security profile including an attribute {See devine, ci6:L46-55, wherein this 
reads over "describes what entitlements the user may have within any single service"}; and 
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using the search strategy to build a pattern having a set of attributes to be used 
when searching for information in the knowledge base, such that the information 
is associated with the set of attributes in the pattern {See lei, ci3:L55-ci4:L32, 
wherein this reads over "[d]ynamic predicate attachment involves selectively adding predicates to 
queries that access database objects, such as tables and views"}. 

18. Claims 11 and 18 is rejected under 35 U.S.C. 103(a) as being unpatentable over LEI, in view of 
DEVINE, and in further view of Official Notice. 

19. As per dependent claims 11 and 18, LEI, in combination with Official Notice, discloses a 
method wherein the knowledge base is selected from a group consisting of a problem knowledge base, a 
solution knowledge base, and a business partner knowledge base. It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to select a knowledge base from a group 
consisting of the aforementioned knowledge bases since a user may desire to access problems of a given 
problem type and consequently a solution knowledge base to find a correlated solution to the problem. 

Response to Arguments 

20. Applicants arguments with respect to claims 1-10, 12-17, and 19-22 have been considered but 
are moot in view of the new ground(s) of rejection. 

Conclusion 

21. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of 
the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 
of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 
shortened statutory period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing 
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date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the date of this final action. 



22. Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Paul Kim whose telephone number is (571) 272-2737. The examiner can normally be 
reached on M-F, 9am - 5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Apu 
Mofiz can be reached on (571) 272-4080. The fax phone number for the organization where this 
application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 
866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Paul Kim 

Patent Examiner, Art Unit 2161 
TECH Center 2100 




SAM RIMELL 
PRIMARY EXAMINER 



